[{"data":1,"prerenderedAt":2343},["ShallowReactive",2],{"content:\u002F2026\u002Fctfshow-web":3,"surround:\u002F2026\u002Fctfshow-web":2332},{"id":4,"title":5,"body":6,"categories":2227,"date":2229,"description":2230,"draft":2231,"extension":2232,"image":2233,"meta":2234,"navigation":2236,"path":2237,"permalink":2238,"published":2238,"readingTime":2239,"recommend":2139,"references":2238,"seo":2244,"sitemap":2245,"stem":2328,"tags":2329,"type":2330,"updated":2229,"__hash__":2331},"content\u002Fposts\u002F2026\u002Fctfshow-web.md","ctfshow-web-信息搜集",{"type":7,"value":8,"toc":2130},"minimark",[9,13,16,24,30,45,52,63,69,75,78,81,92,97,138,141,147,225,230,238,248,255,267,271,281,300,303,369,383,385,388,394,397,405,416,422,425,468,478,484,487,490,500,503,509,511,514,517,532,536,543,549,563,569,571,574,577,585,589,624,630,636,638,641,644,647,651,658,661,667,670,681,687,696,699,705,708,714,719,725,731,733,736,739,742,745,749,769,772,780,786,791,797,802,808,813,819,825,830,836,842,848,850,853,857,863,870,876,882,884,887,893,896,902,905,911,917,923,929,935,941,943,946,949,963,969,973,976,982,988,994,996,999,1002,1014,1017,1023,1029,1035,1038,1044,1050,1053,1057,1071,1078,1084,1090,1094,1104,1110,1114,1117,1123,1127,1130,1136,1140,1143,1149,1155,1158,1164,1167,1172,1176,1186,1189,1197,1200,1206,1212,1215,1225,1231,1233,1237,1243,1249,1255,1264,1270,1276,1279,1282,1285,1291,1294,1300,1310,1316,1319,1325,1327,1331,1337,1340,1346,1350,1354,1427,1431,1434,1438,1448,1454,1460,1462,1465,1468,1475,1479,1541,1545,1548,1554,1560,1566,1572,1574,1578,1584,1590,1593,1596,1602,1606,1614,1620,1624,1627,1631,1643,1646,1652,1659,1665,1669,1672,1678,1687,1693,1695,1698,1706,1712,1718,1725,1728,1734,1738,1752,1763,1767,1773,1779,1782,1785,1790,1794,1798,1852,1868,1871,1877,1883,1887,1890,1893,1897,1902,1907,1913,1919,1925,1928,1934,1937,1940,1944,1947,1950,1958,1964,1966,1969,1975,1978,1984,1988,2085,2089,2099,2108,2112,2118,2124],[10,11,12],"h2",{"id":12},"信息搜集",[10,14,15],{"id":15},"web03",[17,18,19],"p",{},[20,21],"img",{"alt":22,"src":23},"Snipaste_2026-10-20_23-57-36","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-20_23-57-36.png",[17,25,26],{},[20,27],{"alt":28,"src":29},"Snipaste_2026-10-20_23-52-10","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-20_23-52-10.png",[17,31,32,36,37,40,41,44],{},[33,34,35],"code",{"code":35},"ctrl+shift+I","或",[33,38,39],{"code":39},"F12",",",[33,42,43],{"code":43},"ctrl+u","查看源代码,啥也没有怎么办？",[17,46,47,48,51],{},"根据题目提示的，",[33,49,50],{"code":50},"没有思路的时候抓个包看看","，这里用到的抓包工具是Burp Suite（下面都简称burp）",[17,53,54,55,58,59,62],{},"在burp中的Proxy拦截，点击图中的红色框框，把拦截到的发送到Repeater中,再点击",[33,56,57],{"code":57},"send","就可以在",[33,60,61],{"code":61},"Response","中看到flag了",[17,64,65],{},[20,66],{"alt":67,"src":68},"Snipaste_2026-10-21_00-08-11","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-08-11.png",[17,70,71],{},[20,72],{"alt":73,"src":74},"Snipaste_2026-10-21_00-10-09","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-10-09.png",[76,77],"hr",{},[10,79,80],{"id":80},"web04",[17,82,83,84,87,88,91],{},"题目提示了",[33,85,86],{"code":86},"robots","文件，直接在url后边加上",[33,89,90],{"code":90},"robots.txt","即可",[93,94,96],"h3",{"id":95},"关于robotstxt","关于robots.txt",[98,99,100,119],"ul",{},[101,102,103,104,106,107,109,110,112,113,115,116,118],"li",{},"但是，光是提示一个",[33,105,86],{"code":86},",我怎么知道是",[33,108,90],{"code":90},"呢，这是猜出来的吗？不，",[33,111,90],{"code":90},"这个名字是标准规定好的。所以看到",[33,114,86],{"code":86},",就做出在url写",[33,117,90],{"code":90},"对于熟练的人来说是很自然的一个动作，对于不太熟练的，看多了就记住了。",[101,120,121,122,125,126,128,129,131,132,134],{},"其实，我们还可以用工具扫描来解：我这里用的工具是dirsearch",[123,124],"br",{},"因为，dirsearch的字典里有",[33,127,90],{"code":90},",所以它直接给我们扫出来了，但是关于",[33,130,90],{"code":90},"的内容我们还是要知道的,其次就是，虽然扫描很方便，但扫描也存在局限性，所以能够根据提示做出来的，就优先提示吧",[123,133],{},[20,135],{"alt":136,"src":137},"image-20261021181349472","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021181349472.png",[93,139,140],{"id":140},"再记住三个状态码",[17,142,143],{},[20,144],{"alt":145,"src":146},"image-20261021181720999","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021181720999.png",[148,149,150,166],"table",{},[151,152,153],"thead",{},[154,155,156,160,163],"tr",{},[157,158,159],"th",{},"状态码",[157,161,162],{},"含义",[157,164,165],{},"说明",[167,168,169,181,203,214],"tbody",{},[154,170,171,175,178],{},[172,173,174],"td",{},"200",[172,176,177],{},"存在且能读",[172,179,180],{},"拿到了",[154,182,183,186,189],{},[172,184,185],{},"301",[172,187,188],{},"重定向",[172,190,191,192,195,196,199,200],{},"常见于访问目录不带 ",[33,193,194],{"code":194},"\u002F","，比如 ",[33,197,198],{"code":198},"\u002F.git"," → ",[33,201,202],{"code":202},"\u002F.git\u002F",[154,204,205,208,211],{},[172,206,207],{},"403",[172,209,210],{},"存在但被禁止",[172,212,213],{},"目录在，但禁止列目录（可以再试具体文件）",[154,215,216,219,222],{},[172,217,218],{},"404",[172,220,221],{},"不存在",[172,223,224],{},"注意：很多站会返回自定义 404 页面，长度都相同",[226,227,229],"h4",{"id":228},"关于200可能是软404","关于200（可能是软404）",[17,231,232,233,237],{},"200 只代表“服务器成功返回了内容”， ",[234,235,236],"strong",{},"不代表这个文件真的存在","。",[17,239,240,241,244,245,237],{},"有些站点（尤其是前端路由的站）会对",[234,242,243],{},"任何路径","都返回 200 + 首页， 这叫 ",[234,246,247],{},"软 404",[17,249,250,251,254],{},"所以扫到 200 之后，还要",[234,252,253],{},"打开看内容","：",[98,256,257,264],{},[101,258,259,260,263],{},"内容是 ",[33,261,262],{"code":262},"User-agent: ... \u002F Disallow: ..."," → 真存在",[101,265,266],{},"内容是首页 HTML → 软 404，是假的",[93,268,270],{"id":269},"一个url拆开是这样的","一个URL拆开是这样的",[272,273,278],"pre",{"className":274,"code":276,"language":277},[275],"language-text","https:\u002F\u002Fxxx.challenge.ctf.show \u002F system1103 \u002F login.php ? a=1\n└────── 协议+主机 ──────┘   └──────── path ────────┘ └query┘\n","text",[33,279,276],{"__ignoreMap":280},"",[17,282,283,284,287,288,291,292,295,296,299],{},"Web 服务器（nginx \u002F Apache）启动时会配置一个",[234,285,286],{},"网站根目录","（DocumentRoot，比如 ",[33,289,290],{"code":290},"\u002Fvar\u002Fwww\u002Fhtml","）。你请求 ",[33,293,294],{"code":294},"\u002Findex.php","，服务器就去 ",[33,297,298],{"code":298},"\u002Fvar\u002Fwww\u002Fhtml\u002Findex.php"," 找这个文件。",[17,301,302],{},"所以：",[98,304,305,323,360],{},[101,306,307,322],{},[234,308,309,312,313,312,315,312,318,321],{},[33,310,311],{"code":311},"index.php","、",[33,314,90],{"code":90},[33,316,317],{"code":317},"www.zip",[33,319,320],{"code":320},".git\u002F","，在\"写法\"上完全一样","，都是\"根目录下的一个名字\"。没有任何语法区别。",[101,324,325,326,328,329],{},"区别只在",[123,327],{},"服务器拿到这个名字之后怎么处理：",[98,330,331,341],{},[101,332,333,336,337,340],{},[33,334,335],{"code":335},".php"," → 交给 PHP 解释器",[234,338,339],{},"执行","，你只看到它输出的 HTML，看不到源码；",[101,342,343,346,347,346,350,346,353,199,356,359],{},[33,344,345],{"code":345},".txt"," \u002F ",[33,348,349],{"code":349},".zip",[33,351,352],{"code":352},".png",[33,354,355],{"code":355},".git\u002Fxxx",[234,357,358],{},"当静态文件原样返回","（zip 会变成下载）。",[101,361,362,363,312,366,237],{},"所以\"能不能访问到\"取决于两件事：",[234,364,365],{},"文件到底存不存在",[234,367,368],{},"服务器有没有禁止访问它",[17,370,371,375,379],{},[20,372],{"alt":373,"src":374},"Snipaste_2026-10-21_00-18-34","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-18-34.png",[20,376],{"alt":377,"src":378},"Snipaste_2026-10-21_00-17-34","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-17-34.png",[20,380],{"alt":381,"src":382},"Snipaste_2026-10-21_00-18-01","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-18-01.png",[76,384],{},[10,386,387],{"id":387},"web05",[17,389,390],{},[20,391],{"alt":392,"src":393},"Snipaste_2026-10-21_00-34-46","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-34-46.png",[17,395,396],{},"题目提示了phps源码泄露，加之这题又是那种看源码啥也没有的，在url输入index.phps",[93,398,400,401,404],{"id":399},"为什么phps可以看到源码","为什么",[33,402,403],{"code":403},".phps","可以看到源码？",[98,406,407],{},[101,408,409,411,412,415],{},[33,410,335],{"code":335},"是",[33,413,414],{"code":414},"被执行的","，我们是看不到源码的",[272,417,420],{"className":418,"code":419,"language":277},[275],"浏览器请求 \u002Findex.php\n   → 服务器发现是 .php\n   → 交给 PHP 解释器执行\n   → 执行结果（HTML）返回给浏览器\n",[33,421,419],{"__ignoreMap":280},[17,423,424],{},"我们在页面上按 Ctrl+U 看到的只是输出，不是源码",[98,426,427,452],{},[101,428,429,431,432,435,436,442,444,445,447,448,451],{},[33,430,403],{"code":403}," 是一个",[234,433,434],{},"历史遗留配置","：Apache 的 PHP 模块支持",[272,437,440],{"className":438,"code":439,"language":277},[275],"AddType application\u002Fx-httpd-php-source .phps\n",[33,441,439],{"__ignoreMap":280},[123,443],{},"意思是\"",[33,446,403],{"code":403}," 后缀的文件，输出",[234,449,450],{},"语法高亮后的源码","，不要执行\"。这本意是给开发者调试用的，一旦线上开着就是源码泄露",[101,453,454,455,458,459,461,462,464,465,467],{},"所以为什么是",[33,456,457],{"code":457},"index.phps","???",[123,460],{},"因为首页文件叫 ",[33,463,311],{"code":311},"，只是把后缀换成 ",[33,466,403],{"code":403}," 而已",[17,469,470,474],{},[20,471],{"alt":472,"src":473},"Snipaste_2026-10-21_00-28-58","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-28-58.png",[20,475],{"alt":476,"src":477},"Snipaste_2026-10-21_00-29-41","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-29-41.png",[17,479,480],{},[20,481],{"alt":482,"src":483},"Snipaste_2026-10-21_00-29-18","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-29-18.png",[93,485,486],{"id":486},"扫描的局限性",[17,488,489],{},"这题解完之后我还用扫描工具试了一下，结果全是404，这说明什么？",[17,491,492,493,496,497,499],{},"如下图所示，不难看出，我扫描的文件后缀名是php\u002Fasp\u002Faspx\u002Fzip\u002Fhtml等，并没有这一题的后缀名",[33,494,495],{"code":495},"phps",",所以才扫不到，因为",[33,498,495],{"code":495},"没那么常见，不在扫描字典里，从这里我们不难看出，扫描的局限性其实就是，万一文件的后缀名不常见，那就扫不出来",[17,501,502],{},"那也可以把以后写题遇到的，不常见的后缀名全部加到字典中，扩大扫描的范围",[17,504,505],{},[20,506],{"alt":507,"src":508},"image-20261021192247975","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021192247975.png",[76,510],{},[10,512,513],{"id":513},"web06",[93,515,516],{"id":516},"题目提示",[518,519,520,526,529],"ol",{},[101,521,522,523],{},"“解压源码”说明存在",[33,524,525],{"code":525},"压缩包",[101,527,528],{},"“到当前目录，测试正常就收工了”说明：“到当前目录”->在网站根目录，“测试正常就收工“->没删掉",[101,530,531],{},"未知：这个压缩包叫什么",[93,533,535],{"id":534},"为什么是wwwzip","为什么是www.zip?",[17,537,538,539,542],{},"因为www是网站根目录的习惯名，在打包的时候",[33,540,541],{"code":541},"习惯了","用根目录命名压缩包。",[17,544,545,548],{},[234,546,547],{},"这是“人的习惯”，不是标准。"," 所以它不是“唯一正确答案”，而是“命中率最高的答案”。",[17,550,551,555,559],{},[20,552],{"alt":553,"src":554},"Snipaste_2026-10-21_00-58-07","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-58-07.png",[20,556],{"alt":557,"src":558},"Snipaste_2026-10-21_00-59-30","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_00-59-30.png",[20,560],{"alt":561,"src":562},"Snipaste_2026-10-21_01-00-12","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_01-00-12.png",[17,564,565],{},[20,566],{"alt":567,"src":568},"Snipaste_2026-10-21_01-03-48","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002FSnipaste_2026-10-21_01-03-48.png",[76,570],{},[10,572,573],{"id":573},"web07",[93,575,516],{"id":576},"题目提示-1",[98,578,579,582],{},[101,580,581],{},"”版本控制“：说明这题运用了版本控制工具（git\u002Fsvn),它们在初始化时，会在项目根目录自动生成一个隐藏目录git-.git    svn-.svn  所以我们要做的就是去找这个隐藏目录",[101,583,584],{},"\"不要部署到生产环境\"说明，本来不应该部署到生产环境的，但在这一题中部署了",[93,586,588],{"id":587},"关于git","关于.git",[98,590,591,606,615,618],{},[101,592,593,594,597,598,601,602,605],{},"为什么以点开头：linux的约定,",[234,595,596],{},"点开头的文件\u002F目录算隐藏文件","，",[33,599,600],{"code":600},"ls"," 默认不显示。 没有任何规则要求点前面必须有字母——",[33,603,604],{"code":604},".git"," 就是一个完整名字。",[101,607,608,609],{},".git里面装了什么",[272,610,613],{"className":611,"code":612,"language":277},[275],".git\u002F\n├── HEAD        当前在哪个分支\n├── config      仓库配置（远程地址、有时含凭据）\n├── index       暂存区：所有被跟踪文件的文件名清单\n├── objects\u002F    所有文件内容 + 每次提交（zlib 压缩）\n├── refs\u002F       分支、tag 指向哪个 commit\n└── logs\u002F       操作历史（谁、什么时候、改了什么）\n",[33,614,612],{"__ignoreMap":280},[101,616,617],{},"最重要的是index里边有文件名列表,ogjects里边有文件完整内容，这两样可以把项目还原出来，而它们都在.git下",[101,619,620,621,623],{},"301：目录存在，看图中\u002F.git 是301说明这个目录是有的",[123,622],{},"200： \u002F.git\u002F 和\u002F.git相比较，就多了个斜杠，\u002F....\u002F代表访问的是目录",[17,625,626],{},[20,627],{"alt":628,"src":629},"image-20261021100657678","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021100657678.png",[17,631,632],{},[20,633],{"alt":634,"src":635},"image-20261021101442440","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021101442440.png",[76,637],{},[10,639,640],{"id":640},"web08",[93,642,516],{"id":643},"题目提示-2",[17,645,646],{},"和web07一样，只不过这题是.svn",[93,648,650],{"id":649},"关于svn","关于SVN",[17,652,653,654,657],{},"SVN 全称 ",[234,655,656],{},"Subversion","，是 git 流行之前最主流的版本控制工具",[17,659,660],{},"老版本（1.6以前）",[272,662,665],{"className":663,"code":664,"language":277},[275],".svn\u002F\n├── entries          文件名 + 版本号清单（纯文本）\n└── text-base\u002F       每个文件的“原始副本”\n    ├── index.php.svn-base\n    ├── config.php.svn-base\n    └── ...\n",[33,666,664],{"__ignoreMap":280},[17,668,669],{},"text-base\u002F里边存的是文件的明文副本，文件名规则是：源文件名+.svn-base",[17,671,672,673,676,677,680],{},"所以拿到 ",[33,674,675],{"code":675},".svn"," 之后，",[234,678,679],{},"不需要任何还原工具","，直接访问：",[272,682,685],{"className":683,"code":684,"language":277},[275],"\u002F.svn\u002Ftext-base\u002Findex.php.svn-base\n",[33,686,684],{"__ignoreMap":280},[17,688,689,690,692,693,237],{},"返回的就是 ",[33,691,311],{"code":311}," 的",[234,694,695],{},"完整源码",[17,697,698],{},"新版本（1.7+）",[272,700,703],{"className":701,"code":702,"language":277},[275],".svn\u002F\n├── wc.db        SQLite 数据库：记录路径、版本、校验和\n└── pristine\u002F    按 SHA1 命名的文件内容\n    ├── 0a\u002F\n    │   └── abcdef...\n",[33,704,702],{"__ignoreMap":280},[17,706,707],{},"这时内容不是明文文件名了， 需要工具来解析：",[272,709,712],{"className":710,"code":711,"language":277},[275],"perl rip-svn.pl -v -u http:\u002F\u002F目标\u002F.svn\u002F\n",[33,713,711],{"__ignoreMap":280},[17,715,716],{},[234,717,718],{},"这题简化了",[17,720,721],{},[20,722],{"alt":723,"src":724},"image-20261021102153899","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021102153899.png",[17,726,727],{},[20,728],{"alt":729,"src":730},"image-20261021102126198","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021102126198.png",[76,732],{},[10,734,735],{"id":735},"web09",[93,737,516],{"id":738},"题目提示-3",[17,740,741],{},"看到vim，以后条件反射：",[17,743,744],{},"**vim 编辑文件时会留下临时文件，这个临时文件里存着文件内容。**这是找编辑器留下的痕迹",[93,746,748],{"id":747},"关于swp","关于.swp",[98,750,751,757,760],{},[101,752,753,754,237],{},"vim 在编辑一个文件时，会在旁边创建一个",[234,755,756],{},"交换文件（swap file）",[101,758,759],{},"定时把内存里的编辑缓冲区写到磁盘，断电，ssh断了，数据还能恢复",[101,761,762,763],{},"所以交换文件里边的的内容就是文件内容本身，相当于copy了一份",[272,764,767],{"className":765,"code":766,"language":277},[275],"index.php       ← 线上运行的文件\nindex.php.swp   ← 编辑器里那份内容的副本\n",[33,768,766],{"__ignoreMap":280},[93,770,771],{"id":771},"vim",[17,773,774],{},[234,775,776,777],{},"标准写法：原文件名前加一个点，后面加 ",[33,778,779],{"code":779},".swp",[272,781,784],{"className":782,"code":783,"language":277},[275],"原文件：index.php\n交换文件：.index.php.swp      ← 注意前面那个点\n",[33,785,783],{"__ignoreMap":280},[17,787,788],{},[234,789,790],{},"如果第一个交换文件已存在，会依次变成：",[272,792,795],{"className":793,"code":794,"language":277},[275],".index.php.swo\n.index.php.swn\n",[33,796,794],{"__ignoreMap":280},[17,798,799],{},[234,800,801],{},"vim 还会留下其他痕迹：",[272,803,806],{"className":804,"code":805,"language":277},[275],".index.php~        ← 备份文件（保存前的旧版本）\n.index.php.un~     ← undo 历史\n.index.php.swp     ← 交换文件\n",[33,807,805],{"__ignoreMap":280},[17,809,810],{},[234,811,812],{},"这次访问的是",[272,814,817],{"className":815,"code":816,"language":277},[275],"\u002Findex.php.swp     ← 没有前面那个点\n",[33,818,816],{"__ignoreMap":280},[17,820,821,822,237],{},"说明这个环境里放的正是",[234,823,824],{},"不带点的变体",[17,826,827],{},[234,828,829],{},"但是实战里两个都要试",[272,831,834],{"className":832,"code":833,"language":277},[275],"\u002F.index.php.swp\n\u002Findex.php.swp\n",[33,835,833],{"__ignoreMap":280},[17,837,838],{},[20,839],{"alt":840,"src":841},"image-20261021103811884","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021103811884.png",[17,843,844],{},[20,845],{"alt":846,"src":847},"image-20261021103744443","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021103744443.png",[76,849],{},[10,851,852],{"id":852},"web10",[93,854,856],{"id":855},"cookie是什么","Cookie是什么？",[17,858,859,860],{},"一组",[234,861,862],{},"存在你浏览器里的键值对",[17,864,865,866,869],{},"这题看到flag有",[33,867,868],{"code":868},"%7B%7D","说明是URL编码，需要解码",[17,871,872],{},[20,873],{"alt":874,"src":875},"image-20261021104555503","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021104555503.png",[17,877,878],{},[20,879],{"alt":880,"src":881},"image-20261021104527507","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021104527507.png",[76,883],{},[10,885,886],{"id":886},"web12",[272,888,891],{"className":889,"code":890,"language":277},[275],"找后台地址  →  从页面公开信息里找密码  →  登录后台  →  flag\n   \u002Fadmin         手机号 \u002F QQ \u002F 邮箱          admin + 密码\n",[33,892,890],{"__ignoreMap":280},[93,894,895],{"id":895},"后台地址admin从哪来",[17,897,898,901],{},[234,899,900],{},"来源是 robots.txt","（就是 web04 学的那招）",[93,903,904],{"id":904},"密码从哪来",[17,906,907,910],{},[234,908,909],{},"有时候网站上的公开信息，就是管理员常用密码","  为什么网页中给你一串数字，好难猜哟~",[17,912,913],{},[20,914],{"alt":915,"src":916},"image-20261021210657805","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021210657805.png",[17,918,919],{},[20,920],{"alt":921,"src":922},"image-20261021114533163","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021114533163.png",[17,924,925],{},[20,926],{"alt":927,"src":928},"image-20261021210718559","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021210718559.png",[17,930,931],{},[20,932],{"alt":933,"src":934},"image-20261021210516371","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021210516371.png",[17,936,937],{},[20,938],{"alt":939,"src":940},"image-20261021114505451","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021114505451.png",[76,942],{},[10,944,945],{"id":945},"web13",[93,947,516],{"id":948},"题目提示-4",[17,950,951,954,955,958,959,962],{},[234,952,953],{},"① 技术文档"," → 去站上找文档 ",[234,956,957],{},"② 敏感信息"," → 文档里有不该出现的东西 ",[234,960,961],{},"③ 默认密码"," → 后台用了默认密码，而且没改",[272,964,967],{"className":965,"code":966,"language":277},[275],"首页 → 页脚 document 链接\n     → 下载技术文档\n     → 文档里写着后台地址 + 默认账号密码\n     → 访问 \u002Fsystem1103\u002Flogin.php\n     → 登录 → flag\n",[33,968,966],{"__ignoreMap":280},[93,970,972],{"id":971},"为什么是document","为什么是document？",[17,974,975],{},"因为那一小段英文就document首字母是小写，别的都是大写，为了引起你的注意",[17,977,978],{},[20,979],{"alt":980,"src":981},"image-20261021211101953","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021211101953.png",[17,983,984],{},[20,985],{"alt":986,"src":987},"image-20261021115735139","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021115735139.png",[17,989,990],{},[20,991],{"alt":992,"src":993},"image-20261021115634984","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261021115634984.png",[76,995],{},[10,997,998],{"id":998},"web14",[93,1000,1001],{"id":1001},"题目信息",[98,1003,1004,1011],{},[101,1005,1006,1007,1010],{},"editor提示了这题可以往",[33,1008,1009],{"code":1009},"编辑器","的方向去思考",[101,1012,1013],{},"”如果目录不存在，则会遍历服务器根目录“",[17,1015,1016],{},"先查看一下源码，发现没线索",[17,1018,1019],{},[20,1020],{"alt":1021,"src":1022},"image-20261022011347276","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022011347276.png",[17,1024,1025],{},[20,1026],{"alt":1027,"src":1028},"image-20261022011435491","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022011435491.png",[17,1030,1031],{},[20,1032],{"alt":1033,"src":1034},"image-20261022011854488","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022011854488.png",[17,1036,1037],{},"扫描得到\u002Feditor\u002F目录，访问一下",[17,1039,1040],{},[20,1041],{"alt":1042,"src":1043},"image-20261022012020957","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022012020957.png",[17,1045,1046],{},[20,1047],{"alt":1048,"src":1049},"image-20261022023956600","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022023956600.png",[17,1051,1052],{},"这就是一个editor的界面的demo页",[93,1054,1056],{"id":1055},"为什么能确定这是一个demo界面","为什么能确定这是一个demo界面？",[17,1058,1059,1060,1063,1064,1067,1068,237],{},"页面底部 ",[33,1061,1062],{"code":1062},"提交内容（提交快捷键: Ctrl + Enter）"," 是 KindEditor 自带 ",[33,1065,1066],{"code":1066},"php\u002Fdemo.php"," 的原样输出——",[234,1069,1070],{},"说明整个安装包被扔到了网站根下，连示例都没删",[17,1072,1073,1074,1077],{},"既然 ",[33,1075,1076],{"code":1076},"\u002Feditor\u002F"," 是完整安装包，那它下面必然有：",[272,1079,1082],{"className":1080,"code":1081,"language":277},[275],"\u002Feditor\u002F\n├── kindeditor.js            ← 主程序\n├── plugins\u002F                 ← 各种插件（filemanager、insertfile、image...）\n├── themes\u002F                  ← 皮肤\n├── php\u002F\n│   ├── demo.php             ← 看到的这个页面\n│   ├── file_manager_json.php ← 文件空间的后端（本题主角）\n│   ├── upload_json.php      ← 上传的后端\n│   └── JSON.php\n├── asp\u002F  asp.net\u002F  jsp\u002F     ← 其他语言版本，也在！\n└── attached\u002F                ← 上传文件存放目录（默认应该在这）\n",[33,1083,1081],{"__ignoreMap":280},[17,1085,1086],{},[20,1087],{"alt":1088,"src":1089},"image-20261022012129727","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022012129727.png",[93,1091,1093],{"id":1092},"为什么点var","为什么点var?",[17,1095,1096,1097,237,1100,1103],{},"Linux 的网站默认放在 ",[33,1098,1099],{"code":1099},"\u002Fvar\u002Fwww",[234,1101,1102],{},"它命中的的可能性比较大","——它让你少点几次，但不保证对。",[17,1105,1106],{},[20,1107],{"alt":1108,"src":1109},"image-20261022012335424","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022012335424.png",[93,1111,1113],{"id":1112},"为什么选www","为什么选www?",[17,1115,1116],{},"在前边的web题目中我们也遇到过，www就是常见的网站文件夹",[17,1118,1119],{},[20,1120],{"alt":1121,"src":1122},"image-20261022012258113","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022012258113.png",[93,1124,1126],{"id":1125},"为什么先选了html","为什么先选了html?",[17,1128,1129],{},"因为，html是前端三件套，该文件夹以此命名，说明是与网站有关的",[17,1131,1132],{},[20,1133],{"alt":1134,"src":1135},"image-20261022012945470","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022012945470.png",[93,1137,1139],{"id":1138},"为什么选nothinghere","为什么选nothinghere?",[17,1141,1142],{},"你不觉得，它很具有迷惑性吗？nothinghere这里啥也没有,你真信啊？",[17,1144,1145],{},[20,1146],{"alt":1147,"src":1148},"image-20261022013013714","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022013013714.png",[17,1150,1151],{},[20,1152],{"alt":1153,"src":1154},"image-20261022013049593","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022013049593.png",[17,1156,1157],{},"flooog.txt 和flag很像啊，大概率就是它，而且这下边只有这一个文件，你也只能点它，点击确定",[17,1159,1160],{},[20,1161],{"alt":1162,"src":1163},"image-20261022013125383","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022013125383.png",[93,1165,1166],{"id":1166},"关于绝对路径",[17,1168,1169],{},[33,1170,1171],{"code":1171},"\u002Fvar\u002Fwww\u002Fhtml\u002Fnothinghere\u002Ffl000g.txt",[226,1173,1175],{"id":1174},"为什么它是绝对路径","为什么它是绝对路径？",[17,1177,1178,1179,1181,1182,1185],{},"在linux系统中，根（\u002F)就是这个斜杠，var\u002Fwww\u002Fhtml\u002Fnothinghere\u002F  是文件夹，fl000g.txt是文件名，",[33,1180,194],{"code":194},"也叫",[33,1183,1184],{"code":1184},"磁盘根",",是linux整个硬盘的起点，这需要我们有一些linux相关的基础知识",[93,1187,1188],{"id":1188},"关于网站根",[17,1190,1191,1192,1194,1195,237],{},"网站根简称站根，网站根目录 = Web 服务器“对外开放”的那个起点文件夹。浏览器 URL 里的那个 ",[33,1193,194],{"code":194},"，指的就是它，不是硬盘的 ",[33,1196,194],{"code":194},[93,1198,1199],{"id":1199},"分清三个根",[272,1201,1204],{"className":1202,"code":1203,"language":277},[275],"① 磁盘根        \u002F                        ← Linux 整个硬盘的起点\n② 网站根        \u002Fvar\u002Fwww\u002Fhtml             ← 网站“对外营业”的起点（DocRoot）\n③ URL 根        https:\u002F\u002Fhost\u002F             ← 浏览器眼里的起点，对应 ②\n",[33,1205,1203],{"__ignoreMap":280},[272,1207,1210],{"className":1208,"code":1209,"language":277},[275],"磁盘根  \u002F\n ├── bin\u002F  dev\u002F  etc\u002F  home\u002F  lib\u002F  ...   ← 后厨，URL 访问不到\n └── var\u002F\n      └── www\u002F\n           └── html\u002F        ←←← 网站根（DocRoot）\n                ├── index.php        →  URL: \u002F\n                ├── editor\u002F          →  URL: \u002Feditor\u002F\n                ├── assets\u002F          →  URL: \u002Fassets\u002F\n                └── nothinghere\u002F\n                     └── fl000g.txt  →  URL: \u002Fnothinghere\u002Ffl000g.txt\n",[33,1211,1209],{"__ignoreMap":280},[93,1213,1214],{"id":1214},"绝对路径转换到url路径",[17,1216,1217,1218,1220,1221,1224],{},"由于url的根在html后边，从\u002F开始，所以我们可以根据",[33,1219,1171],{"code":1171},"把url路径，",[33,1222,1223],{"code":1223},"\u002Fnothinghere\u002Ffl000g.txt","写到url中,如图所示",[17,1226,1227],{},[20,1228],{"alt":1229,"src":1230},"image-20261022014417305","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022014417305.png",[76,1232],{},[10,1234,1236],{"id":1235},"web15这题还蛮有意思的","web15（这题还蛮有意思的）",[17,1238,1239],{},[20,1240],{"alt":1241,"src":1242},"image-20261022121419013","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022121419013.png",[17,1244,1245],{},[20,1246],{"alt":1247,"src":1248},"image-20261022121847971","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022121847971.png",[17,1250,1251],{},[20,1252],{"alt":1253,"src":1254},"image-20261022123157449","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022123157449.png",[17,1256,1257,1258,1263],{},"这里用到了QQ邮箱的一个特点：QQ邮箱一般都是qq号",[1259,1260,1262],"a",{"href":1261},"mailto:+@qq.com","+@qq.com","  这个qq号可能后面会用上，可能是密码什么的（像web12一样），也可能是其他的",[17,1265,1266,1267],{},"看源码你会发现，没有什么信息，然后观察一下这个网站，是那种登录的，需要你输入name,和email,熟悉吗？和web12有点像，那是不是可以采取web12的思路呢，在url，写",[33,1268,1269],{"code":1269},"\u002Fadmin",[17,1271,1272],{},[20,1273],{"alt":1274,"src":1275},"image-20261022122606861","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022122606861.png",[17,1277,1278],{},"还真有，后台的管理员登录系统，可以先试一下，账号：admin \u002F demo  密码：1156631961  或 0000000 或 12586954775",[17,1280,1281],{},"都试一下发现，都不是",[93,1283,1284],{"id":1284},"忘记密码是不是可以看看",[17,1286,1287],{},[20,1288],{"alt":1289,"src":1290},"image-20261022123555555","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022123555555.png",[17,1292,1293],{},"没招了，看看前面，有什么信息还没用？qq号，如果不是密码，那能不能去qq搜一下呢",[17,1295,1296],{},[20,1297],{"alt":1298,"src":1299},"image-20261022124026135","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022124026135.png",[17,1301,1302,1303,1306,1307],{},"好嘛，搜完得到地址是陕西安，回到重置密码那里，填入",[33,1304,1305],{"code":1305},"陕西西安","不对，填",[33,1308,1309],{"code":1309},"西安",[17,1311,1312],{},[20,1313],{"alt":1314,"src":1315},"image-20261022124111365","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022124111365.png",[17,1317,1318],{},"拿到密码，回到管理员登录界面，试试看，账号：admin  密码：admin7789",[17,1320,1321],{},[20,1322],{"alt":1323,"src":1324},"image-20261022124255721","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022124255721.png",[76,1326],{},[10,1328,1330],{"id":1329},"web16阴魂不散的化学元素周期表","web16(阴魂不散的化学元素周期表)",[17,1332,1333],{},[20,1334],{"alt":1335,"src":1336},"image-20261022124829645","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022124829645.png",[17,1338,1339],{},"这个网站做的很炫酷",[17,1341,1342],{},[20,1343],{"alt":1344,"src":1345},"image-20261022151802936","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022151802936.png",[93,1347,1349],{"id":1348},"为什么提示探针就知道要访问tzphp","为什么提示探针就知道要访问\u002Ftz.php?",[226,1351,1353],{"id":1352},"关于tzphp","关于tz.php",[98,1355,1356,1386,1389,1410,1417],{},[101,1357,1358,1361,1362,1365,1366,1369,1370,1373,1374,1377,1378,1381,1382,1385],{},[33,1359,1360],{"code":1360},"tz.php"," 是「雅黑 PHP 探针」的",[234,1363,1364],{},"默认文件名","，而 ",[33,1367,1368],{"code":1368},"tz"," 就是「",[234,1371,1372],{},"探","针」的",[234,1375,1376],{},"拼音首字母","（",[234,1379,1380],{},"t","an ",[234,1383,1384],{},"z","hen）。它既不是 PHP 的规则，也不是 CTF 的约定，只是老站长们多年来一直这样做，于是这个文件名就成了固定叫法。",[101,1387,1388],{},"早期用 VPS 建站的人想查看服务器的 CPU、内存、硬盘、PHP 版本、禁用的函数等，就会上传一个「PHP 探针」脚本。",[101,1390,1391,1392,1395,1396,1399,1400,1377,1403,1406,1407,1409],{},"国内最流行的是 ",[234,1393,1394],{},"雅黑 PHP 探针","（官网 ",[33,1397,1398],{"code":1398},"yahei.net","）。它的下载包就叫 ",[33,1401,1402],{"code":1402},"tz.zip",[33,1404,1405],{"code":1405},"yahei.net\u002Ftz\u002Ftz.zip","），解压后主文件是 ",[33,1408,1360],{"code":1360},"，直接放在网站根目录就能访问。",[101,1411,1412,1413,1416],{},"所有教程、一键安装包（LNMP 等）用的都是这个文件名，",[234,1414,1415],{},"没有人改名","。时间一长，\"探针 → tz.php\" 就成了行业里的习惯叫法。",[101,1418,1419,1420,1423,1424,1426],{},"所以严格来说，",[234,1421,1422],{},"它并不是“探针就等于 tz.php”这种等价关系","；这里的意思是：圈内默认使用雅黑探针，而雅黑探针的默认文件名就是 ",[33,1425,1360],{"code":1360},"。如果换一个探针程序，文件名就会改变。",[93,1428,1430],{"id":1429},"怎么知道要点击php信息中的phpinfo的","怎么知道要点击PHP信息中的PHPINFO的？",[17,1432,1433],{},"其实这个是我一个个试出来的，当我进入到这个界面的时候，有没有别的提示，就只能一个个看，每一个都点一遍，看看哪里有东西，结果刚好看到phpinfo,其实flag藏在这里面的情况还挺常见的，有的还会藏在apache环境里，这也算是ctf会常出现的题吧",[93,1435,1437],{"id":1436},"怎么快速找到藏在phpinfo里边的flag","怎么快速找到藏在phpinfo里边的flag?",[17,1439,1440,1443,1444,1447],{},[33,1441,1442],{"code":1442},"ctrl","+",[33,1445,1446],{"code":1446},"F","查询flag,\u002Fctfshow就可以定位到含flag的地方",[17,1449,1450],{},[20,1451],{"alt":1452,"src":1453},"image-20261022150424638","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022150424638.png",[17,1455,1456],{},[20,1457],{"alt":1458,"src":1459},"image-20261022144441342","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022144441342.png",[76,1461],{},[10,1463,1464],{"id":1464},"web17",[93,1466,1001],{"id":1467},"题目信息-1",[17,1469,1470,1471,1474],{},"备份文件+sql,看到",[33,1472,1473],{"code":1473},"sql","不要直接以为就是sql注入",[93,1476,1478],{"id":1477},"怎么知道要访问backupsql的","怎么知道要访问\u002Fbackup.sql的？",[98,1480,1481,1519],{},[101,1482,1483,1489,1490,1493,1494,312,1497,312,1500,312,1503,312,1506,312,1509,1512,1513,1515,1516,237],{},[234,1484,1485,1488],{},[33,1486,1487],{"code":1487},"backup"," 是备份文件最普遍、最没有创意的命名。"," 运维用 ",[33,1491,1492],{"code":1492},"mysqldump"," 备份数据库时，想到的名字几乎都是 ",[33,1495,1496],{"code":1496},"backup.sql",[33,1498,1499],{"code":1499},"db.sql",[33,1501,1502],{"code":1502},"database.sql",[33,1504,1505],{"code":1505},"data.sql",[33,1507,1508],{"code":1508},"xxx_backup.sql",[33,1510,1511],{"code":1511},"20261022.sql","。和上一题的 ",[33,1514,1360],{"code":1360}," 是同一个道理（见上一问）：",[234,1517,1518],{},"默认文件名保持默认，就等于问答题变成了填空题",[101,1520,1521,1524,1525,1528,1529,1532,1533,1536,1537,1540],{},[234,1522,1523],{},"放在网站根目录，才会「泄露」。"," ",[33,1526,1527],{"code":1527},".sql"," 不是 PHP，Web 服务器只会把它当普通文件返回，所以 URL 加 ",[33,1530,1531],{"code":1531},"\u002Fbackup.sql"," 就直接触发下载。如果备份放在 ",[33,1534,1535],{"code":1535},"\u002Fvar\u002Fbackup\u002F"," 这种站根（DocRoot）外面，URL 根本访问不到，这份文件再敏感也没事。所以这题真正的漏洞是",[234,1538,1539],{},"备份文件被放进了对外可访问的目录","，并非「有一个 sql 文件」。",[93,1542,1544],{"id":1543},"如果backupsql不中怎么办","如果\u002Fbackup.sql不中怎么办？",[17,1546,1547],{},"按「备份文件字典」挨个试，或直接扫后缀：",[272,1549,1552],{"className":1550,"code":1551,"language":277,"meta":280},[275],"backup.sql   db.sql   database.sql   data.sql\nwww.sql      1.sql    sql.sql        ctfshow.sql\nbackup_20261022.sql   \u002Fbackup\u002Fbackup.sql   \u002Fdb\u002Fbackup.sql\n",[33,1553,1551],{"__ignoreMap":280},[17,1555,1556],{},[20,1557],{"alt":1558,"src":1559},"image-20261022153519515","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022153519515.png",[17,1561,1562],{},[20,1563],{"alt":1564,"src":1565},"image-20261022153342627","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022153342627.png",[17,1567,1568],{},[20,1569],{"alt":1570,"src":1571},"image-20261022153426719","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022153426719.png",[76,1573],{},[10,1575,1577],{"id":1576},"web18这题也好玩","web18(这题也好玩)",[17,1579,1580],{},[20,1581],{"alt":1582,"src":1583},"image-20261022155109766","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022155109766.png",[17,1585,1586],{},[20,1587],{"alt":1588,"src":1589},"image-20261022162231729","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022162231729.png",[17,1591,1592],{},"这是个游戏界面，先试着玩两把，题目说玩到101分给flag,反正我是玩不到那么多的了",[17,1594,1595],{},"那就查看查看源码吧",[17,1597,1598],{},[20,1599],{"alt":1600,"src":1601},"image-20261022162547376","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022162547376.png",[93,1603,1605],{"id":1604},"为什么选择js","为什么选择.js?",[17,1607,1608,1609,1443,1611,1613],{},"这就是web前端三件套的内容了，其实你也可以，每一个都点进去，然后",[33,1610,1442],{"code":1442},[33,1612,1446],{"code":1446},"查询flag，最终还是会找到.js的",[17,1615,1616],{},[20,1617],{"alt":1618,"src":1619},"image-20261022162739241","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022162739241.png",[93,1621,1623],{"id":1622},"红框中的那串字母是是什么","红框中的那串字母是是什么？",[17,1625,1626],{},"它是 JavaScript 的 Unicode 转义序列，格式为 \\u + 4 位十六进制数，表示一个字符的码点（编码编号）。",[93,1628,1630],{"id":1629},"怎么识别出来那串字母是转义序列","怎么识别出来那串字母是转义序列？",[17,1632,1633],{},[234,1634,1635,1636,1639,1640],{},"一眼识别：",[33,1637,1638],{"code":1638},"\\u"," + 4 位十六进制 ",[33,1641,1642],{"code":1642},"[0-9a-fA-F]",[17,1644,1645],{},"这就是它的“签名”，三个特征同时满足：",[272,1647,1650],{"className":1648,"code":1649,"language":277},[275],"\\u4f60\n││└─┴── 4 位十六进制（0-9, a-f）\n│└────── 字母 u（Unicode 的首字母）\n└─────── 反斜杠（转义序列的起手式）\n",[33,1651,1649],{"__ignoreMap":280},[17,1653,1654,1655,1658],{},"在实际代码里，它几乎总是",[234,1656,1657],{},"成串、6 个字符一组","出现，这个节奏感非常显眼：（记住这个特征就行）",[272,1660,1663],{"className":1661,"code":1662,"language":277},[275],"\\u4f60 \\u8d62 \\u4e86 \\uff0c \\u53bb \\u5e7a \\u5e7a \\u96f6 \\u70b9 ...\n  你     赢     了     ，     去     幺     幺     零     点\n",[33,1664,1662],{"__ignoreMap":280},[93,1666,1668],{"id":1667},"怎么让它正常显示呢","怎么让它正常显示呢？",[17,1670,1671],{},"把它复制粘贴到控制台，如果控制台不给粘贴，就在里边敲“允许粘贴”并按回车键就好了",[17,1673,1674],{},[20,1675],{"alt":1676,"src":1677},"image-20261022163950578","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022163950578.png",[17,1679,1680,1683,1684],{},[33,1681,1682],{"code":1682},"你赢了，去幺幺零点皮爱吃皮看看","提示你去访问",[33,1685,1686],{"code":1686},"110.php",[17,1688,1689],{},[20,1690],{"alt":1691,"src":1692},"image-20261022160120785","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022160120785.png",[76,1694],{},[10,1696,1697],{"id":1697},"web19",[98,1699,1700,1703],{},[101,1701,1702],{},"先试试弱口令（虽然大概率是不对的）",[101,1704,1705],{},"试试查看源码",[17,1707,1708],{},[20,1709],{"alt":1710,"src":1711},"image-20261022205355587","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022205355587.png",[17,1713,1714],{},[20,1715],{"alt":1716,"src":1717},"image-20261022205335532","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022205335532.png",[17,1719,1720,1721],{},"值得一提的是有没有发现，这种关键信息都在",[1722,1723,1724],"script",{}," 里，所以你懂的，以后可以重点看看里边的代码",[93,1726,1727],{"id":1727},"解法一",[17,1729,1730],{},[20,1731],{"alt":1732,"src":1733},"image-20261022205214151","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022205214151.png",[93,1735,1737],{"id":1736},"为什么uadminpa599ac85a73384ee3219fa684296eaa62667238d608efa81837030bd1ce1bf04行不通","为什么u=admin&p=a599ac85a73384ee3219fa684296eaa62667238d608efa81837030bd1ce1bf04行不通？",[17,1739,1740,1743,1744,1748,1749],{},[234,1741,1742],{},"注意看源代码","：POST",[1745,1746,1747],"span",{},"'username'","  post",[1745,1750,1751],{},"'pazzword'",[17,1753,1754,1755,1758,1759,1762],{},"所以真正的参数名",[33,1756,1757],{"code":1757},"username","和",[33,1760,1761],{"code":1761},"pazzword",",这就是为什么u=admin&p=a599ac85a73384ee3219fa684296eaa62667238d608efa81837030bd1ce1bf04行不通，但是图中的却可以的原因",[93,1764,1766],{"id":1765},"为什么不用key和iv","为什么不用key和iv?",[17,1768,1769],{},[20,1770],{"alt":1771,"src":1772},"image-20261022210827846","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022210827846.png",[17,1774,1775],{},[20,1776],{"alt":1777,"src":1778},"image-20261022210949673","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022210949673.png",[17,1780,1781],{},"为什么不用key和vi啊，这个看着也挺像回事的，挺像账号和密码的？其实是干扰项",[17,1783,1784],{},"仔细看，encrypt函数在做AES加密，在函数checkForm中，提交的key，和iv会先加密再返回，加密过后就无法满足===(强等于了)",[17,1786,1787],{},[234,1788,1789],{},"所以，这里采用hackbar工具，POST参数，将script里边的哈希字符串绕过js加密,符合===强等于，可拿到flag",[93,1791,1793],{"id":1792},"关于字符串怎么知道它是哈希","关于字符串，怎么知道它是哈希？",[518,1795,1796],{},[101,1797],{},[98,1799,1800,1825,1839,1849],{},[101,1801,1802,1803,312,1806,312,1809,312,1812,312,1815,312,1818,312,1821,1824],{},"变量名\u002F字段名：",[33,1804,1805],{"code":1805},"password",[33,1807,1808],{"code":1808},"pass",[33,1810,1811],{"code":1811},"pwd",[33,1813,1814],{"code":1814},"hash",[33,1816,1817],{"code":1817},"key",[33,1819,1820],{"code":1820},"token",[33,1822,1823],{"code":1823},"sign","；",[101,1826,1827,1828,346,1831,1834,1835,1838],{},"出现在 ",[33,1829,1830],{"code":1830},"===",[33,1832,1833],{"code":1833},"=="," 比较、数据库 ",[33,1836,1837],{"code":1837},"users"," 表、配置文件、Cookie\u002FSession 里；",[101,1840,1841,1842,312,1845,1848],{},"和 salt 拼在一起：",[33,1843,1844],{"code":1844},"hash:salt",[33,1846,1847],{"code":1847},"md5($pass.$salt)"," 这类格式，长度会偏离标准值；",[101,1850,1851],{},"题目提示里出现“密钥”“不要放在前端”“签名”等字眼。",[17,1853,1854,1855,1858,1859,1861,1862,312,1864,1867],{},"这题就是典型：源码里的 ",[33,1856,1857],{"code":1857},"$p"," 被拿去和一段 64 位 hex 做 ",[33,1860,1830],{"code":1830},"，同时旁边就有 ",[33,1863,1817],{"code":1817},[33,1865,1866],{"code":1866},"iv","，这些线索已经足以看出它的用途。",[17,1869,1870],{},"2.实在不确定，就上工具",[17,1872,1873],{},[20,1874],{"alt":1875,"src":1876},"image-20261022213731387","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022213731387.png",[17,1878,1879],{},[20,1880],{"alt":1881,"src":1882},"image-20261022205256653","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022205256653.png",[93,1884,1886],{"id":1885},"解法二获取明文","解法二（获取明文）",[17,1888,1889],{},"通过代码，我们可以知道它的加密逻辑,和密文，那为什么不试试，解密拿到明文登录呢？",[17,1891,1892],{},"在解法一里边我们分析了它是AES加密",[226,1894,1896],{"id":1895},"关于aes加密","关于AES加密",[17,1898,1899,1901],{},[234,1900,1817],{},"：密钥",[17,1903,1904,1906],{},[234,1905,1866],{},":偏移量",[17,1908,1909,1912],{},[234,1910,1911],{},"密文","：a599ac85a73384ee3219fa684296eaa62667238d608efa81837030bd1ce1bf04",[17,1914,1915,1918],{},[234,1916,1917],{},"模式","：代码中写了mode:CBC",[17,1920,1921,1924],{},[234,1922,1923],{},"填充方式","：zeropadding 解密工具里没有zeropadding那就nopadding",[17,1926,1927],{},"可以找一个AES在线解密工具",[17,1929,1930],{},[20,1931],{"alt":1932,"src":1933},"image-20261022222253193","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022222253193.png",[17,1935,1936],{},"账号：admin 密码明文：图中解密得到的字符串",[17,1938,1939],{},"我看别的题解有这个方法，但是不知道为什么，现在这个明文，登不上，可能是题目问题，那就作为一个思路补充吧",[93,1941,1943],{"id":1942},"解法三获取明文","解法三（获取明文）",[17,1945,1946],{},"好像获取明文的解题方法现在都用不了，但是以前的题解有人解除了，说账号admin密码就是i_want_a_36d_girl,登陆不上不用太过纠结，作为思路补充",[17,1948,1949],{},"可以在控制台输入解密函数",[272,1951,1956],{"className":1952,"code":1954,"language":1955,"meta":280},[1953],"language-js","function decryptHex(data, key, iv) {\n    var key1 = CryptoJS.enc.Latin1.parse(key);\n    var iv1  = CryptoJS.enc.Latin1.parse(iv);\n    return CryptoJS.AES.decrypt(\n        { ciphertext: CryptoJS.enc.Hex.parse(data) },   \u002F\u002F 关键：Hex → WordArray\n        key1,\n        { iv: iv1, mode: CryptoJS.mode.CBC, padding: CryptoJS.pad.ZeroPadding }\n    ).toString(CryptoJS.enc.Utf8);                       \u002F\u002F 关键：按 UTF-8 输出\n}\n\ndecryptHex(\n    'a599ac85a73384ee3219fa684296eaa62667238d608efa81837030bd1ce1bf04',\n    '0000000372619038',\n    'ilove36dverymuch'\n);\n\u002F\u002F \"i_want_a_36d_girl\"\n","js",[33,1957,1954],{"__ignoreMap":280},[17,1959,1960],{},[20,1961],{"alt":1962,"src":1963},"image-20261022224719275","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261022224719275.png",[76,1965],{},[10,1967,1968],{"id":1968},"web20",[17,1970,1971],{},[20,1972],{"alt":1973,"src":1974},"image-20261023001726209","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261023001726209.png",[17,1976,1977],{},"根据题目提示访问\u002Fdb\u002Fdb.mdb",[17,1979,1980],{},[20,1981],{"alt":1982,"src":1983},"image-20261023001937621","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261023001937621.png",[93,1985,1987],{"id":1986},"怎么想到dbdbmdb这个路径的","怎么想到\u002Fdb\u002Fdb.mdb这个路径的？",[518,1989,1990,2006,2020,2066],{},[101,1991,1992,1995,1996,312,1999,312,2002,2005],{},[234,1993,1994],{},"看提示做技术栈指纹","：页面说「asp + access」，或响应头有 ",[33,1997,1998],{"code":1998},"Server: Microsoft-IIS\u002F6.0",[33,2000,2001],{"code":2001},"X-Powered-By: ASP.NET",[33,2003,2004],{"code":2004},"Set-Cookie: ASPSESSIONID...","，就锁定老式 Windows\u002FIIS 站。",[101,2007,2008,254,2011,2013,2014,312,2016,2019],{},[234,2009,2010],{},"找入口",[33,2012,90],{"code":90},"、源码注释、",[33,2015,1269],{"code":1269},[33,2017,2018],{"code":2018},"\u002Flogin.asp","、报错页泄露的物理路径。",[101,2021,2022,2025,2026,312,2029,312,2032,312,2035,312,2038,312,2041,2044,2045,312,2048,312,2051,312,2054,312,2057,312,2060,312,2063],{},[234,2023,2024],{},"按惯例猜","：这类老站目录命名高度套路化—— ",[33,2027,2028],{"code":2028},"db\u002F",[33,2030,2031],{"code":2031},"data\u002F",[33,2033,2034],{"code":2034},"database\u002F",[33,2036,2037],{"code":2037},"databack\u002F",[33,2039,2040],{"code":2040},"bak\u002F",[33,2042,2043],{"code":2043},"backup\u002F"," 文件名：",[33,2046,2047],{"code":2047},"db.mdb",[33,2049,2050],{"code":2050},"data.mdb",[33,2052,2053],{"code":2053},"database.mdb",[33,2055,2056],{"code":2056},"#db.mdb",[33,2058,2059],{"code":2059},"admin.mdb",[33,2061,2062],{"code":2062},"news.mdb",[33,2064,2065],{"code":2065},"db.asa",[101,2067,2068,254,2071,312,2074,312,2077,2080,2081,2084],{},[234,2069,2070],{},"目录扫描兜底",[33,2072,2073],{"code":2073},"dirsearch",[33,2075,2076],{"code":2076},"ffuf",[33,2078,2079],{"code":2079},"gobuster","、7kbscan + 敏感文件字典，把 ",[33,2082,2083],{"code":2083},"mdb\u002Fasa\u002Fasp\u002Fzip\u002Frar\u002Fbak"," 都挂上。",[93,2086,2088],{"id":2087},"关于mdb","关于.mdb",[17,2090,2091,2094,2095,2098],{},[33,2092,2093],{"code":2093},".mdb"," 是 ",[234,2096,2097],{},"Microsoft Access 数据库文件","（Microsoft Database），也是早期 Windows 生态里最常见的“文件型数据库”。",[17,2100,2101,2107],{},[234,2102,2103,2104,2106],{},"一个 ",[33,2105,2093],{"code":2093}," 文件本身就是一个完整的关系型数据库","，里面装着表、字段、索引、数据，还装着 Access 的窗体、报表、查询、宏、VBA 模块——不像 MySQL 那样是一堆文件加一个服务进程。",[93,2109,2111],{"id":2110},"用数据库查看工具打开mdb文件","用数据库查看工具打开.mdb文件",[17,2113,2114,2115],{},"这里我用的工具是",[234,2116,2117],{},"MDB Viewer Plus",[17,2119,2120],{},[20,2121],{"alt":2122,"src":2123},"image-20261023002044204","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261023002044204.png",[17,2125,2126],{},[20,2127],{"alt":2128,"src":2129},"image-20261023002109909","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261023002109909.png",{"title":280,"searchDepth":2131,"depth":2131,"links":2132},4,[2133,2135,2136,2144,2149,2153,2157,2161,2166,2169,2173,2177,2191,2194,2201,2206,2212,2222],{"id":12,"depth":2134,"text":12},2,{"id":15,"depth":2134,"text":15},{"id":80,"depth":2134,"text":80,"children":2137},[2138,2140,2143],{"id":95,"depth":2139,"text":96},3,{"id":140,"depth":2139,"text":140,"children":2141},[2142],{"id":228,"depth":2131,"text":229},{"id":269,"depth":2139,"text":270},{"id":387,"depth":2134,"text":387,"children":2145},[2146,2148],{"id":399,"depth":2139,"text":2147},"为什么.phps可以看到源码？",{"id":486,"depth":2139,"text":486},{"id":513,"depth":2134,"text":513,"children":2150},[2151,2152],{"id":516,"depth":2139,"text":516},{"id":534,"depth":2139,"text":535},{"id":573,"depth":2134,"text":573,"children":2154},[2155,2156],{"id":576,"depth":2139,"text":516},{"id":587,"depth":2139,"text":588},{"id":640,"depth":2134,"text":640,"children":2158},[2159,2160],{"id":643,"depth":2139,"text":516},{"id":649,"depth":2139,"text":650},{"id":735,"depth":2134,"text":735,"children":2162},[2163,2164,2165],{"id":738,"depth":2139,"text":516},{"id":747,"depth":2139,"text":748},{"id":771,"depth":2139,"text":771},{"id":852,"depth":2134,"text":852,"children":2167},[2168],{"id":855,"depth":2139,"text":856},{"id":886,"depth":2134,"text":886,"children":2170},[2171,2172],{"id":895,"depth":2139,"text":895},{"id":904,"depth":2139,"text":904},{"id":945,"depth":2134,"text":945,"children":2174},[2175,2176],{"id":948,"depth":2139,"text":516},{"id":971,"depth":2139,"text":972},{"id":998,"depth":2134,"text":998,"children":2178},[2179,2180,2181,2182,2183,2184,2185,2188,2189,2190],{"id":1001,"depth":2139,"text":1001},{"id":1055,"depth":2139,"text":1056},{"id":1092,"depth":2139,"text":1093},{"id":1112,"depth":2139,"text":1113},{"id":1125,"depth":2139,"text":1126},{"id":1138,"depth":2139,"text":1139},{"id":1166,"depth":2139,"text":1166,"children":2186},[2187],{"id":1174,"depth":2131,"text":1175},{"id":1188,"depth":2139,"text":1188},{"id":1199,"depth":2139,"text":1199},{"id":1214,"depth":2139,"text":1214},{"id":1235,"depth":2134,"text":1236,"children":2192},[2193],{"id":1284,"depth":2139,"text":1284},{"id":1329,"depth":2134,"text":1330,"children":2195},[2196,2199,2200],{"id":1348,"depth":2139,"text":1349,"children":2197},[2198],{"id":1352,"depth":2131,"text":1353},{"id":1429,"depth":2139,"text":1430},{"id":1436,"depth":2139,"text":1437},{"id":1464,"depth":2134,"text":1464,"children":2202},[2203,2204,2205],{"id":1467,"depth":2139,"text":1001},{"id":1477,"depth":2139,"text":1478},{"id":1543,"depth":2139,"text":1544},{"id":1576,"depth":2134,"text":1577,"children":2207},[2208,2209,2210,2211],{"id":1604,"depth":2139,"text":1605},{"id":1622,"depth":2139,"text":1623},{"id":1629,"depth":2139,"text":1630},{"id":1667,"depth":2139,"text":1668},{"id":1697,"depth":2134,"text":1697,"children":2213},[2214,2215,2216,2217,2218,2221],{"id":1727,"depth":2139,"text":1727},{"id":1736,"depth":2139,"text":1737},{"id":1765,"depth":2139,"text":1766},{"id":1792,"depth":2139,"text":1793},{"id":1885,"depth":2139,"text":1886,"children":2219},[2220],{"id":1895,"depth":2131,"text":1896},{"id":1942,"depth":2139,"text":1943},{"id":1968,"depth":2134,"text":1968,"children":2223},[2224,2225,2226],{"id":1986,"depth":2139,"text":1987},{"id":2087,"depth":2139,"text":2088},{"id":2110,"depth":2139,"text":2111},[2228],"web","2026-10-20 23:09:00","web-wp",false,"md","\u002Fimages\u002Fctf-show\u002FScreenshots-20261021-183601708.png",{"slots":2235},{},true,"\u002F2026\u002Fctfshow-web",null,{"text":2240,"minutes":2241,"time":2242,"words":2243},"25 min read",24.79,1487400,4958,{"title":5,"description":2230},{"loc":2237,"images":2246},[2247,2248,2249,2250,2251,2252,2253,2254,2255,2256,2257,2258,2259,2260,2261,2262,2263,2264,2265,2266,2267,2268,2269,2270,2271,2272,2273,2274,2275,2276,2277,2278,2279,2280,2281,2282,2283,2284,2285,2286,2287,2288,2289,2290,2291,2292,2293,2294,2295,2296,2297,2298,2299,2300,2301,2302,2303,2304,2305,2306,2307,2308,2309,2310,2311,2312,2313,2314,2315,2316,2317,2318,2319,2320,2321,2322,2323,2324,2325,2326,2327],{"loc":23},{"loc":29},{"loc":68},{"loc":74},{"loc":137},{"loc":146},{"loc":374},{"loc":378},{"loc":382},{"loc":393},{"loc":473},{"loc":477},{"loc":483},{"loc":508},{"loc":554},{"loc":558},{"loc":562},{"loc":568},{"loc":629},{"loc":635},{"loc":724},{"loc":730},{"loc":841},{"loc":847},{"loc":875},{"loc":881},{"loc":916},{"loc":922},{"loc":928},{"loc":934},{"loc":940},{"loc":981},{"loc":987},{"loc":993},{"loc":1022},{"loc":1028},{"loc":1034},{"loc":1043},{"loc":1049},{"loc":1089},{"loc":1109},{"loc":1122},{"loc":1135},{"loc":1148},{"loc":1154},{"loc":1163},{"loc":1230},{"loc":1242},{"loc":1248},{"loc":1254},{"loc":1275},{"loc":1290},{"loc":1299},{"loc":1315},{"loc":1324},{"loc":1336},{"loc":1345},{"loc":1453},{"loc":1459},{"loc":1559},{"loc":1565},{"loc":1571},{"loc":1583},{"loc":1589},{"loc":1601},{"loc":1619},{"loc":1677},{"loc":1692},{"loc":1711},{"loc":1717},{"loc":1733},{"loc":1772},{"loc":1778},{"loc":1876},{"loc":1882},{"loc":1933},{"loc":1963},{"loc":1974},{"loc":1983},{"loc":2123},{"loc":2129},"posts\u002F2026\u002Fctfshow-web",[2228,12],"tech","kzSJ4nzE5--wFMW3QWlbydrpwZIJnHv0cZP-Dn7leg4",[2333,2338],{"title":2334,"path":2335,"stem":2336,"date":2337,"type":2330,"children":-1},"php伪协议+base64过滤","\u002F2026\u002Fphp","posts\u002F2026\u002Fphp","2026-10-19 22:03:29",{"title":2339,"path":2340,"stem":2341,"date":2342,"type":2330,"children":-1},"ctfshow-web-爆破","\u002F2026\u002Fctfshow-web-baopo","posts\u002F2026\u002Fctfshow-web-爆破","2026-10-25 01:15:00",1793524344822]